Hacker who launched DDoS attacks on Sony, EA, and Steam gets 27 months in prison

Six years later, DerpTrolling, the hacker who started all the Christmas DDoS attacks, gets prison time.
Written by Catalin Cimpanu, Contributor
Derp trolling meme face

A 23-year-old man from Utah was sentenced this week to 27 months in prison for a series of DDoS attacks that took down online gaming service providers like Sony's PlayStation Network, Valve's Steam, Microsoft's Xbox, EA, Riot Games, Nintendo, Quake Live, DOTA2, and League of Legends servers, along with many others.

Named Austin Thompson, but known online as DerpTrolling, the man is the first hacker who started a trend among other hackers and hacking crews -- namely of launching DDoS attacks against gaming providers during Christmas, which they later justified using ridiculous reasons such as "to spoil everyone's holiday," "to make people spend time with their families," or "for the lulz."

The hacker's DDoS attacks were extremely successful at the time, in 2013, in a time when most companies didn't use strong DDoS mitigation services.

At the time, Thompson used the @DerpTrolling Twitter account to announce attacks and take requests for services users wanted him to take down.

While the hacker had been active since 2011, his most famous stretch of activity was between December 2013 and January 2014, when most of his high-profile DDoS attacks took place, before the account going inactive.

The attacks caused many online gaming services to go offline, and after seeing DerpTrolling success and the media coverage the hacker got, many other hacking crews followed suit in subsequent years.

Hacker groups like Lizard Squad launched DDoS attacks on Christmas in 2014, a group called Phantom Squad did the same in 2015, R.I.U. Star Patrol in 2016, and several lone hackers last year, in 2017, but with less success than the previous years.

This annual trend of DDoS attacks on gaming services over the Christmas holiday prompted the FBI to act. The agency, together with law enforcement from the UK and the Netherlands seized the domains of 15 DDoS-for-hire services last year, in December, in an attempt to prevent any DDoS attacks -- which eventually proved successful.

Thompson was arrested in 2014 after getting doxed. He pleaded guilty in November 2018.

According to Thompson's sentencing document obtained by ZDNet, the hacker must also pay $95,000 in restitution to Daybreak Games, (formerly Sony Online Entertainment), and is scheduled to start his 27 months prison sentence on August 27.

"Denial-of-service attacks cost businesses and individuals millions of dollars annually," said US Attorney Robert Brewer. "We are committed to prosecuting hackers who intentionally disrupt internet access."

The FBI's most wanted cybercriminals

Related malware and cybercrime coverage:

Editorial standards